图书简介
Discover how the internals of malware work and how you can analyze and detect it. You will learn not only how to analyze and reverse malware, but also how to classify and categorize it, giving you insight into the intent of the malware. Malware Analysis and Detection Engineering is a one-stop guide to malware analysis that simplifies the topic by teaching you undocumented tricks used by analysts in the industry. You will be able to extend your expertise to analyze and reverse the challenges that malicious software throws at you.The book starts with an introduction to malware analysis and reverse engineering to provide insight on the different types of malware and also the terminology used in the anti-malware industry. You will know how to set up an isolated lab environment to safely execute and analyze malware. You will learn about malware packing, code injection, and process hollowing plus how to analyze, reverse, classify, and categorize malware using static and dynamic tools. You will be able to automate your malware analysis process by exploring detection tools to modify and trace malware programs, including sandboxes, IDS/IPS, anti-virus, and Windows binary instrumentation.The book provides comprehensive content in combination with hands-on exercises to help you dig into the details of malware dissection, giving you the confidence to tackle malware that enters your environment.What You Will LearnAnalyze, dissect, reverse engineer, and classify malwareEffectively handle malware with custom packers and compilersUnpack complex malware to locate vital malware components and decipher their intentUse various static and dynamic malware analysis tools Leverage the internals of various detection engineering tools to improve your workflow Write Snort rules and learn to use them with Suricata IDSWho This Book Is ForSecurity professionals, malware analysts, SOC analysts, incident responders, detection engineers, reverse engineers, and network security engineers"This book is a beast! If you?re looking to master the ever-widening field of malware analysis, look no further. This is the definitive guide for you." Pedram Amini, CTO Inquest; Founder OpenRCE.org and ZeroDayInitiative
Part 1: Introduction.- Chapter 1. Introduction.- Chapter2. Malware Analysis Lab Setup.- Part 2: OS and System Fundamentals.- Chapter3. File and File Formats.-Chapter4. Virtual Memory and the Portable Executable (PE) File.- Chapter5. Windows Internals.- Part 3: Malware Components and Analysis.- Chapter6. Malware Components and Distribution.- Chapter7. Malware Packers.- Chapter8. Persistence Mechanisms.- Chapter9. Network Communication.- Chapter 10. Code Injection, Process Hollowing, and API Hooking.- Chapter11. Stealth and Rootkits.- Part 4: Malware Analysis and Classification.- Chapter12. Static Analysis.- Chapter13. Dynamic Analysis.- Chapter14. Memory Forensics With Volatility.- Chapter15. Malware Payload Dissection and Classification.- Part 5: Malware Reverse Engineering.- Chapter16. Debuggers and Assembly Language.- Chapter17. Debugging Tricks for Unpacking Malware.- Chapter18. Debugging Code Injection.- Chapter19. Armoring and Evasion - The Anti Techniques.- Chapter20. File-less, Macros, and Other Malware Trends.- Part 6: Detection Engineering.- Chapter 21. Dev Analysis Lab Setup.- Chapter22. Anti-Virus Engines.- Chapter23. IDS/IPS and Snort/Suricata Rule Writing.- Chapter24. Malware Sandbox Internals.- Chapter25. Binary Instrumentation for Reversing Automation.
Trade Policy 买家须知
- 关于产品:
- ● 正版保障:本网站隶属于中国国际图书贸易集团公司,确保所有图书都是100%正版。
- ● 环保纸张:进口图书大多使用的都是环保轻型张,颜色偏黄,重量比较轻。
- ● 毛边版:即书翻页的地方,故意做成了参差不齐的样子,一般为精装版,更具收藏价值。
关于退换货:
- 由于预订产品的特殊性,采购订单正式发订后,买方不得无故取消全部或部分产品的订购。
- 由于进口图书的特殊性,发生以下情况的,请直接拒收货物,由快递返回:
- ● 外包装破损/发错货/少发货/图书外观破损/图书配件不全(例如:光盘等)
并请在工作日通过电话400-008-1110联系我们。
- 签收后,如发生以下情况,请在签收后的5个工作日内联系客服办理退换货:
- ● 缺页/错页/错印/脱线
关于发货时间:
- 一般情况下:
- ●【现货】 下单后48小时内由北京(库房)发出快递。
- ●【预订】【预售】下单后国外发货,到货时间预计5-8周左右,店铺默认中通快递,如需顺丰快递邮费到付。
- ● 需要开具发票的客户,发货时间可能在上述基础上再延后1-2个工作日(紧急发票需求,请联系010-68433105/3213);
- ● 如遇其他特殊原因,对发货时间有影响的,我们会第一时间在网站公告,敬请留意。
关于到货时间:
- 由于进口图书入境入库后,都是委托第三方快递发货,所以我们只能保证在规定时间内发出,但无法为您保证确切的到货时间。
- ● 主要城市一般2-4天
- ● 偏远地区一般4-7天
关于接听咨询电话的时间:
- 010-68433105/3213正常接听咨询电话的时间为:周一至周五上午8:30~下午5:00,周六、日及法定节假日休息,将无法接听来电,敬请谅解。
- 其它时间您也可以通过邮件联系我们:customer@readgo.cn,工作日会优先处理。
关于快递:
- ● 已付款订单:主要由中通、宅急送负责派送,订单进度查询请拨打010-68433105/3213。
本书暂无推荐
本书暂无推荐